Cybersecurity in Connected Medical Devices

Introduction to Cybersecurity in Connected Medical Devices

When a Continuous Glucose Monitor (CGM) feeds an Automated Insulin Delivery (AID) system, a security flaw stops being only a privacy problem. Glucose devices talk to phone apps and to insulin pumps over Bluetooth, and in closed-loop operation the pump acts on the data it receives [3]. One review calls this web of connected devices and cloud services the Medical Internet of Things [3]. FDA treats cybersecurity as part of device safety and effectiveness [1]. Each connection also adds a path an attacker could try, which is why FDA asks manufacturers to look for risks introduced through interoperation with other devices, not just inside the device itself [1].

Technical Overview of Vulnerabilities

Bluetooth Low Energy (BLE), the low-power version of Bluetooth that most wearable diabetes devices use, has two built-in defenses: authentication, which confirms a connecting device is what it claims to be, and encryption with 128-bit AES [3]. Here's what surprised us: both are optional in the BLE specification. The manufacturer has to enable them; the user can't [3]. The weakest moment is pairing, when two devices first connect. A nearby eavesdropping device may be able to capture key information during pairing and use it to decrypt traffic, a Man-in-the-Middle (MitM) attack, although BLE 5.0 and later versions tightened pairing protection [3]. BLE also hops between radio channels, a technique first developed to resist interception and jamming, but current equipment can intercept those transmissions unless the device uses BLE's security features [3].

Critical Risks and Attack Vectors

The risk that matters most is to data integrity, not privacy. A single intercepted glucose reading tells an attacker very little, but if that reading feeds an insulin dosing decision and someone can substitute a false value, the result could harm the user [3]. That is an integrity attack: spoofed high glucose data pushing an AID algorithm toward more insulin than the body needs [3]. A replay attack resends old, genuine data packets so they look current, and FDA tells manufacturers to assume an adversary controls the network and can "alter, drop, and replay packets" [1].

These risks have already reached real products. In June 2019, FDA warned that older Medtronic MiniMed 508 and Paradigm series insulin pumps had a flaw that let someone nearby connect wirelessly and change the pump's settings, with an insulin overdose as one possible result [4]. It was the first time a connected diabetes device was recalled over cybersecurity [4]. Attacks can also spread. FDA asks manufacturers to show how their systems resist attacks that could harm many patients at once, and notes that a hacked non-device function can be made to perform a device function [1].

Regulatory Framework and Guidance

The SBOM requirement comes from Congress, not from FDA guidance. Section 3305 of the Food and Drug Omnibus Reform Act of 2022, enacted December 29, 2022, added section 524B, "Ensuring Cybersecurity of Medical Devices," to the Federal Food, Drug, and Cosmetic Act [1]. Since March 29, 2023, anyone submitting a premarket application for a "cyber device," such as a 510(k) or a De Novo request, has had to include cybersecurity information. A cyber device is one with sponsor-validated software that can connect to the internet and could be vulnerable to cyber threats [1].

Section 524B requires three things from these manufacturers. They must submit a plan to monitor and address postmarket vulnerabilities, including coordinated vulnerability disclosure. They must keep processes that give reasonable assurance the device and related systems are cybersecure, including postmarket updates and patches. And they must provide a Software Bill of Materials (SBOM), a list of the commercial, open-source and off-the-shelf software components inside the device [1].

FDA's guidance explains how the agency expects manufacturers to meet those requirements, and every page is marked "Contains Nonbinding Recommendations" [1]. As of October 2026, the current edition is dated February 3, 2026. It replaced a June 2025 version, which had itself replaced the September 2023 guidance, and the title now says "Quality Management System" to match FDA's updated quality regulation [1].

Industry Response and Best Practices

FDA's guidance asks manufacturers to decide whether BLE's own protections are enough or whether to add security controls of their own beneath BLE, so the device stays protected if a flaw in the protocol is discovered [1]. The 2020 Bluetooth review adds app-level authentication to that list, because a secure BLE link doesn't stop another app on the same phone from using the connection [3]. For pairing, the same review recommends the strongest available security mode, short pairing windows, lower radio power and Out-of-Band (OOB) techniques such as near-field communication (NFC), the short-range tap technology [3].

FDA's assumption that an attacker already controls the network [1] is the core idea behind Zero Trust design. No connection gets trusted just because it arrived over a familiar channel; FDA recommends that a device and the server it connects to mutually authenticate each session [1]. Premarket submissions should also include penetration test reports, where independent testers try to find and exploit weaknesses before attackers do [1]. Outside FDA, IEEE 2621, a security standard first written for wireless-connected diabetes devices, pairs a test plan with certification by authorized test laboratories [2] [5].

Conclusion

The headline attacks need someone nearby with skill and equipment, and the 2019 recall paper noted that exploiting the MiniMed flaw would take considerable skill [4]. The bigger shift is regulatory. Section 524B applies to premarket submissions made from March 29, 2023 on [1], so devices authorized before that date reached the market without it. If you use an older connected pump or CGM and are weighing whether to keep it, that's a decision to make with your care team. What we couldn't find is public, device-by-device information on which CGMs and pumps add security layers beyond standard BLE.